Privacy policy

General provisions

SE Lietuvos Airports, legal entity code 120864074, registered office address: Rodūnios kelias 10A, Vilnius, Lithuania, tel. No.: +37061244442, e-mail: (hereinafter - Lithuanian Airports) understands that the protection of personal data is important for our customers, suppliers, partners and other persons (hereinafter - data subjects) who cooperate or use the services of Vilnius, Kaunas or Palanga branches of Lithuanian Airports. For this reason, we take all necessary measures to ensure the privacy of each data subject and the exercise of personal data protection rights.

You can contact our appointed Personal Data Protection Officer on all data protection issues by e-mail.

This Privacy Notice provides all information about how we, as Data Controllers, process personal data, including information about the purposes of the processing of personal data and the legal basis, what data is collected and further processed, how long it is stored, to whom it is provided, what rights you have and where you can ask about their implementation or any other issues related to the processing of personal data.

The Privacy Notice applies to natural persons who cooperate with or use the services of any of all three branches of Lithuanian Airports (Vilnius, Kaunas and Palanga), visit our websites, social network accounts, or provide data to us for other purposes.

Our employees and members of the management body are informed about the processing of their personal data in accordance with the procedure established in the internal legal acts of Lithuanian Airports.

The Privacy Notice is prepared in accordance with the following legislation:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as GDPR or Regulation)
Law of the Republic of Lithuania on the Legal Protection of Personal Data of 30 June 2018 no. XIII-1426 (hereinafter - ADTAĮ);
Law of the Republic of Lithuania on Electronic Communications of 15 April 2004 No. IX-2135;
Guidelines of the State Data Protection Inspectorate.

This Privacy Notice is an integral part of the data protection policy approved by Lithuanian Airports.

How do we collect your data?

Depending on the nature of our cooperation, we process personal data as follows:

Received directly from the data subject (you), for example when you send us inquiries, share your experience with the specified contacts, use our parking services, participate in our privilege programs or send us your CV in order to apply for vacancies;

which are generated when you use our services or enter our territory, for example when you visit our website or enter our video surveillance field;
obtained from other sources, such as insurance companies, airlines, other third parties.

For what purposes and what personal data do we process?

Purpose of data processing	Legal basis for processing	Data categories	Duration of data storage
Execution of contracts with suppliers, (sub)contractors	Article 6(1) clause b of GDPR - performance of the contract	Name, surname, personal identification number, date of birth, contact telephone, e-mail, address of representatives of suppliers, (sub)contractors. Name, surname, position, e-mail address, telephone number of the person signing the contract	10 years after the end of the specific contract
Administration of invoices from suppliers and (sub)contractors	Article 6(1) clause c of GDPR - legal obligation	Name, surname, position, address, e-mail address, telephone number	10 years
Training and information for natural persons, non-airport staff working on airport premises	Article 6(1) clause c of GDPR - legal obligation	Company, name, surname, e-mail, telephone number	3 years
Issuing permanent permits	Legal obligation Article 6(1) clause c of GDPR	Name, surname, personal identification number, nationality, telephone number, e-mail address, information on place of residence registered for the last 5 (five) years, place of work, reasons for unemployment, statements, confirmations, information on the functions for which the permit is required, name of the company, position, and confirmation of the accuracy of the personal data, criminal record, criminal convictions, date, certificates from third countries concerning good reputation, name of regime zone, reasons for permanent permit, name of training, date of completion of training, information on who carried out the training, make, model, registration number of the vehicle, owner of vehicle	5 years
Issuing temporary permits	Legal obligation Article 6(1) clause c of GDPR	Name, surname, e-mail, date of birth, telephone number, name of the company where the person is employed, period of the temporary permit, name of the temporary permit area, name of the employee of the company/establishment in charge of the person for whom the temporary permit is requested and the name of the company, the name of the person accompanying the person, the make, model and registration number of the vehicle, the name of the driver	6 months
Issuing permits for driving motor vehicles	Article 6(1) clause c of GDPR - legal obligation	Driving licence number, name, surname, medical details, e-mail address and telephone number	6 months
Issuing permits for drone flights	Article 6(1) clause c of GDPR - legal obligation	Pilot’s licence number, telephone number, name, name of the customer	5 years
Authorisations to apply for permanent residence permits and permanent vehicle permits	Article 6(1) clause c of GDPR - legal obligation	Name, surname, position, e-mail, telephone number, specimen signature	5 years
Receipt of requests to be registered on the list of entities operating in the controlled area	Article 6(1) clause c of GDPR - legal obligation	Name, surname, position, date	5 years
Registration of media representatives for access to the Airport area	Article 6(1) clause c of GDPR - legal obligation	Company, name, surname, e-mail	5 years
Managing applications for tour groups	Article 6(1) clause a of GDPR - consent	Name, surname, personal identification number, date of birth of excursion participants	1 year
Video surveillance, implementation of aviation security measures, protection of Lithuanian airports’ assets and crime prevention	Article 6(1) clause f of GDPR - legitimate interest, Article 6(1) clause c of GDPR - legal obligation	Image, voice, other data visible in the video	30 days
Passenger screening for aviation security	Article 6(1) clause c of GDPR - legal obligation	Name, surname, flight number, flight time	24 hours
Recording telephone conversations for quality assurance purposes	Article 6(1) clause f of GDPR - legitimate interest	Call metadata: voice, time, duration, phone number, call content	6 months
Administration of damages, insured events	Article 6(1) clause c of GDPR - legal obligation, Article 6(1) clause f of GDPR - legitimate interest	Name, surname, personal identification number, information on damaged property, information provided by insurance company and aviation company	10 years
Carrying out direct marketing	Article 6(1) clause a of GDPR - consent	Name, surname, e-mail, telephone number, age, purpose of travel	Until consent is withdrawn
Sending newsletters	Article 6(1) clause a of GDPR - consent	E-mail	Until consent is withdrawn
Organisation of lotteries	Article 6(1) clause f of GDPR - legitimate interest, Article 6(1) clause a of GDPR - consent	Participants’ social account details, winner's e-mail, telephone number, address for delivery of winnings	Until the end of the lottery
Administration of Lithuanian Airports’ websites and social networks	Article 6(1) clause f of GDPR - legitimate interest	Opinions and comments on social networks, name, surname, nickname	Opinions and comments posted on social networks are not deleted
Information collected by cookies	Article 6(1) clause a of GDPR - consent	The specific information collected by cookies can be found in the cookie management window	The duration of the activity of specific cookies can be found in the cookie management window
Dealing with passenger enquiries, complaints and sharing their experiences	Article 6(1) clause b of GDPR - performance of the contract, Article 6(1) clause a of GDPR - consent	Name, surname, e-mail, telephone number, flight details, damage suffered, bank account number and other information provided by the passenger	6 months
Provision of services to very important persons, as provided for in the internal regulations of Lithuanian airports	Article 6(1) clause b of GDPR - performance of the contract	Name, date of arrival/departure, time, flight number, airport of departure/arrival, name of the person(s) picking up/dropping off the passengers, information on the vehicle(s) picking up/dropping off the passenger(s), their model, registration number(s)	6 months
Participation in the Lithuanian Airports Privilege Programme - Privilege Card	Article 6(1) clause a of GDPR - consent	Name, surname, date of birth, e-mail, telephone number, address, visit history	1 year after expiry of the privilege card
Business Club administration	Article 6(1) clause b of GDPR - performance of the contract	Name, surname, flight number, class, loyalty card number, flight time	3 months
Fast Track service	Article 6(1) clause b of GDPR - performance of the contract	Action records - Passenger's passage date, time, airline, name, surname	3 months
Administration of user accounts and orders for the e-shop VNO.lt/e-shop.lt	Article 6(1) clause b of GDPR - performance of the contract	Name, surname, telephone number, e-mail, address.	5 years since the last active actions on your account
Provision of parking services	Article 6(1) clause b of GDPR - performance of the contract	Name, surname, e-mail, vehicle registration number, photo, traffic accident information, parking time, date	10 years
Conducting public property auctions	Article 6(1) clause b of GDPR - performance of the contract	Name, surname, personal identification number, address, telephone number, e-mail, name, surname, telephone number, e-mail of the authorised person, payment order details	10 years
Keeping records of services provided	Article 6(1) clause c of GDPR - legal obligation	Name, surname, position, address, e-mail address, telephone number	10 years
Debt administration	Article 6(1) clause f of GDPR - legitimate interest	Name, surname, personal identification number, amount of debt	5 years, from the date of repayment of the debt
Selection of candidates for vacant positions	Article 6(1) clause a of GDPR - consent, Article 6(1) clause f of GDPR - legitimate interest	Name, surname, telephone number, e-mail, CV data, motivational letter	If no consent has been obtained, until the end of the selection process If consent is given - 6 months.
Selection of candidates for vacant positions	Article 6(1) clause f of GDPR - legitimate interest	Content of the recording of the job interview (oral test)	1 year
Managing the working relationship between the members of the audit committee and the members of management	Article 6(1) clause a of GDPR - consent, Article 6(1) clause f of GDPR - legitimate interest	Name, surname, telephone number, e-mail, salary, length of service, list of related persons (board members and audit committee). Contract, personal identification number, address, bank account, hours worked, total hours	10 years
Event organisation	Article 6(1) clause a of GDPR - consent	Company name, position, name, surname, e-mail address, telephone number	6 months
Keeping records of authorisation of the airports’ users‘ committee	Article 6(1) clause c of GDPR - legal obligation	Name, surname, enterprise/company, position, personal identification number, duration of authorisation	10 years

How do we protect your data?

Lithuanian Airports have implemented proper technical and organizational measures to ensure an appropriate level of security in data processing. We guide the selection and implementation of the technical and organizational measures to ensure the security of data processing:

ENISA guidelines: https://www.enisa.europa.eu/publications/guidelines-for-smes-on-the-security-of-personal-data-processing;
good information security practices;

VDAI guidelines: https://vdai.lrv.lt/uploads/vdai/documents/files/VDAI_saugumo_priemoniu_gaires-2020-06-18.pdf .

To whom do we provide your data?

Lithuanian Airports uses only those data processors that ensure compliance with the GDPR and the same level of personal data security as set out in our personal data protection policy.

Here is a list of categories of data recipients at Lithuanian Airports:

state institutions in accordance with the procedure provided by law;
Data Centre, Hosting, Cloud, Website Administration and Related Services, Software Development, Provisioning, Supporting and Development Companies, IT Infrastructure Services Companies, Communication Services Companies;
subcontractors;
law enforcement authorities at their request or on our own initiative if there is a suspicion that a criminal offense has been committed, as well as courts and other dispute resolution bodies.

Do we provide your data outside the European Union and the European Economic Area?

We ensure that your data is processed in accordance with the requirements and standards established by the legal acts of the European Union and we inform you that your data is processed only within the European Union and the European Economic Area.

Consequences of non-submission

You have the right to refuse to provide your personal data, but the provision of your personal data is necessary and mandatory for the purposes set out in this Privacy Notice, so if you do not provide your personal data, we will not be able to achieve the purposes listed.

What rights do you have and how can you exercise them?

In accordance with the provisions of the GDPR, you, as a data subject, can exercise these rights:

1. The right of access to personal data. I.e. to submit a request for information on whether your personal data is processed, and if personal data is processed, you have the right to access your processed personal data.

2. The right to correct personal data. I.e. to submit a request to correct your personal data if you find that the personal data we process is incorrect, incomplete or inaccurate.

3. The right to delete data (a right “to be forgotten”). I.e. to request the deletion of your personal data if you believe that your data has been processed illegally or fraudulently.

4. The right to restrict data processing. I.e. to make a request to restrict (suspend) the processing of your personal data, except for storage - in case, for example, you request the rectification of your personal data (while the accuracy of personal data is checked and / or corrected), if it is established that personal data is processed unlawfully and you do not consent to the deletion of the data and you have expressed your consent to the processing of your personal data, etc.

5. The right to data transfer. I.e. to submit a request to transfer your personal data, which is processed by automated means, to you and / or another data controller in a systematic, commonly used and computer-readable format.

6. The right to object to data processing. I.e. to object to the processing of personal data where the processing is carried out on a legal basis or on a legal basis in the public interest.

7. The right to request that you are not subject only to a decision based on automated data processing, including profiling, which has legal consequences for you or which has a significant effect on you in a similar way; 

8. The right to withdraw a consent given to us at any time, with regard to the processing of personal data, for example for direct marketing.

You can exercise your rights:

By sending us a free-form request by e-mail: The application must be electronically signed or accompanied by a notarized copy of an identity document in order for us to verify your identity.

By sending the application by registered mail to the address Rodūnios kelias 10A, Vilnius, Lithuania. The application must be signed and accompanied by a notarized copy of your identity document.
You can also exercise your rights through a representative. In this case, your representative must provide your name, contact details, a copy of an identity document certified by a notary, information about you, namely: name, surname, other data on the basis of which we could identify you as a data subject, as well as a notarized copy of the document supporting your representation.

The request must be legible, signed, state the name, address and other details of the data subject in the desired form of communication, information on which of the data subject's rights and to what extent the data subject wishes to exercise.

We will provide a response to your request no later than within 30 (thirty) calendar days from the date of receipt of the request. In exceptional cases requiring additional time, we will, after notifying you, have the right to extend the deadline for submission of the requested data or examination of other requirements specified in your request to 60 (sixty) calendar days from the date of your request.

Where can you submit questions regarding personal data?

If you have any questions regarding the information provided in this Privacy Notice or the protection of your personal data and the exercise of your rights at Lithuanian Airports, please contact our data protection representative in any way convenient for you:

by e-mail:
in writing to the address: Rodūnios kelias 10A, Vilnius, Lietuva.

If a solution that is suitable for both parties cannot be found, you have the right to contact the State Data Protection Inspectorate at the address: L. Sapiegos str. 17, Vilnius.

Cookies

A cookie is a small text file that a website saves in the browser of your computer or mobile device when you visit the website. It allows your website to "remember" your actions and options (such as registration name, language, font size, and other display options) for a period of time so that you don't have to re-enter them each time you visit the site or browse its various pages.

The information collected by cookies allows us to ensure that you can browse more conveniently, as well as learn more about the behavior of website users, analyze trends and improve the website.

You can find out what cookies are used on this page and how to manage them in the cookie control panel of each page.

Final provisions of the Privacy Notice

The Privacy Notice is adjusted at the discretion of the Data Controller or in the event of a change in the requirements of applicable legislation.

The current version of the Privacy Notice is published on the website, so it is recommended that you read the latest version.

Latest version: 16-11-2021.